CVE-2026-34477 Apache Software Foundation CVE debrief

Who should care

Defenders and administrators using Apache Log4j Core versions 2.12.0 through 2.25.3, especially those using SMTP, Socket, or Syslog appenders with TLS configured via a nested <Ssl> element, should assess exposure and upgrade to version 2.25.4.

Why it matters

CVE-2026-34477 is a vulnerability in Apache Log4j Core that allows for man-in-the-middle attacks due to incomplete fix for CVE-2025-68161. Defenders and administrators using affected versions should assess exposure and upgrade to version 2.25.4.

• Man-in-the-middle attacks are possible when using vulnerable configurations
• Verify hostname verification is enabled and properly configured to prevent interception
• Upgrade to Apache Log4j Core 2.25.4 to correct this issue

Technical summary

The fix for CVE-2025-68161 was incomplete, addressing hostname verification only when enabled via the log4j2.sslVerifyHostName system property, but not when configured through the verifyHostName attribute of the <Ssl> element. This leaves TLS connections vulnerable to interception in certain configurations. An attacker may perform a man-in-the-middle attack if an SMTP, Socket, or Syslog appender is in use, TLS is configured via a nested <Ssl> element, and the attacker can present a certificate issued by a trusted CA. The verifyHostName configuration attribute was introduced in Log4j Core 2.12.0, but was silently ignored in all versions through 2.25.3.

Defensive priority

Upgrade to Apache Log4j Core 2.25.4 to correct this issue. Assess exposure for users of SMTP, Socket, or Syslog appenders with TLS configured via a nested <Ssl> element.

Recommended defensive actions

• Upgrade to Apache Log4j Core 2.25.4
• Assess exposure for users of SMTP, Socket, or Syslog appenders with TLS configured via a nested <Ssl> element
• Verify hostname verification is enabled and properly configured
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD vulnerability detail page provide information on the vulnerability, including its description, CVSS score, and affected versions. The fix for CVE-2025-68161 was incomplete, addressing hostname verification only when enabled via the log4j2.sslVerifyHostName system property, but not when configured through the verifyHostName attribute of the <Ssl> element. This leaves TLS connections vulnerable to interception in certain configurations. Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.